@axivoy/api 0.0.0-stage → 1.0.0

package/dist/generated/schema.js

@@ -0,0 +1,5 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export {};

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { AxivoyClient, createAxivoyClient, DEFAULT_BASE_URL, type AxivoyClientOptions, type CallOptions, type DryRunResult, type OperationInput, type OperationKey, type OperationResult, type TokenSource, } from './client.js';
+export { clientCredentials, DEFAULT_TOKEN_URL, type ClientCredentialsOptions } from './auth.js';
+export { AxivoyError, AxivoyProposal, type AxivoyErrorBody, type ProposalBody } from './errors.js';
+export { AxivoyWebhookError, verifyWebhook, type AxivoyEvent, type VerifyOptions } from './webhooks.js';
+export type { paths as AxivoyPaths, webhooks as AxivoyWebhooks } from './generated/schema.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export { AxivoyClient, createAxivoyClient, DEFAULT_BASE_URL, } from './client.js';
+export { clientCredentials, DEFAULT_TOKEN_URL } from './auth.js';
+export { AxivoyError, AxivoyProposal } from './errors.js';
+export { AxivoyWebhookError, verifyWebhook } from './webhooks.js';

package/dist/webhooks.d.ts

@@ -0,0 +1,41 @@
+/** A webhook request body: one domain event. */
+export interface AxivoyEvent<Facts = Record<string, unknown>> {
+    id: string;
+    type: string;
+    version: number;
+    occurred_at: string;
+    effective_at: string | null;
+    tenant: number;
+    subject: {
+        type: string;
+        id: number | string;
+    };
+    sequence: number;
+    facts: Facts;
+    causation: {
+        invocation_id: string | null;
+        event_id: string | null;
+        subscription_id: number | null;
+    };
+    chain_depth: number;
+    fetch: {
+        operation: string;
+        input: Record<string, unknown>;
+    } | null;
+}
+export interface VerifyOptions {
+    /** Oldest signature age accepted, in seconds. Defaults to 300. */
+    toleranceSeconds?: number;
+    /** Clock for tests, in Unix seconds. */
+    now?: number;
+}
+export declare class AxivoyWebhookError extends Error {
+    constructor(message: string);
+}
+/**
+ * Checks the `Axivoy-Signature` header (`t=<unix>,v1=<hex>`: HMAC-SHA256 of
+ * `{t}.{raw body}` with the endpoint secret) and returns the parsed event.
+ * Pass the raw body exactly as received; parsing and re-encoding it breaks
+ * the signature. Throws `AxivoyWebhookError` when it does not match.
+ */
+export declare function verifyWebhook<Facts = Record<string, unknown>>(rawBody: string, signatureHeader: string | null | undefined, secret: string, options?: VerifyOptions): Promise<AxivoyEvent<Facts>>;

package/dist/webhooks.js

@@ -0,0 +1,51 @@
+export class AxivoyWebhookError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AxivoyWebhookError';
+    }
+}
+/**
+ * Checks the `Axivoy-Signature` header (`t=<unix>,v1=<hex>`: HMAC-SHA256 of
+ * `{t}.{raw body}` with the endpoint secret) and returns the parsed event.
+ * Pass the raw body exactly as received; parsing and re-encoding it breaks
+ * the signature. Throws `AxivoyWebhookError` when it does not match.
+ */
+export async function verifyWebhook(rawBody, signatureHeader, secret, options = {}) {
+    const parts = new Map();
+    for (const piece of (signatureHeader ?? '').split(',')) {
+        const [name, value] = piece.trim().split('=', 2);
+        if (name && value) {
+            parts.set(name, [...(parts.get(name) ?? []), value]);
+        }
+    }
+    const timestamp = Number(parts.get('t')?.[0]);
+    const signatures = parts.get('v1') ?? [];
+    if (!Number.isInteger(timestamp) || signatures.length === 0) {
+        throw new AxivoyWebhookError('Missing or malformed Axivoy-Signature header.');
+    }
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - timestamp) > (options.toleranceSeconds ?? 300)) {
+        throw new AxivoyWebhookError('Signature timestamp is outside the tolerance.');
+    }
+    const expected = await hmacHex(secret, `${timestamp}.${rawBody}`);
+    if (!signatures.some((signature) => constantTimeEqual(signature, expected))) {
+        throw new AxivoyWebhookError('Signature does not match.');
+    }
+    return JSON.parse(rawBody);
+}
+async function hmacHex(secret, message) {
+    const encoder = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = new Uint8Array(await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message)));
+    return Array.from(signature, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@axivoy/api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Typed client for the Axivoy API: operations, webhooks and errors.",
+  "license": "MIT",
+  "homepage": "https://app.axivoy.ai/developers",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/meesam-cmd/tooli-middleware.git",
+    "directory": "clients/typescript"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "generate": "openapi-typescript ../../docs/api/openapi-public.json --output src/generated/schema.ts",
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "test": "npm run typecheck && node --test test/client.test.mjs",
+    "smoke": "node scripts/smoke.mjs"
+  },
+  "devDependencies": {
+    "openapi-typescript": "^7.4.0",
+    "typescript": "^5.6.0",
+    "undici": "^6.21.0"
+  }
+}